SAML Response Decoder
Decode a base64-encoded SAML Response or Assertion and inspect it. Auto-detects the HTTP-POST (plain base64) and HTTP-Redirect (DEFLATE-compressed) bindings, extracts a summary of key fields (Issuer, Destination, NameID, Conditions window, AudienceRestriction, attributes, StatusCode) and pretty-prints the decoded XML. A debugging tool for SSO troubleshooting — it does not verify signatures.
Input
Decoded entirely in your browser — the assertion is never uploaded.
The instant to check the Conditions validity window against. Leave blank to use the current time.
Output
Notes
| Level | Message |
|---|---|
| No data yet | |
Summary
| Field | Value |
|---|---|
| No data yet | |
Decoded XML
Guides
Paste a base64-encoded SAML Response or Assertion and instantly see the decoded, pretty-printed XML alongside a plain-language summary of its most important fields. It is built for debugging single sign-on (SSO): when a login fails, the identity provider (IdP) and service provider (SP) exchange an opaque blob, and this tool turns that blob back into something you can actually read.
What it does
The decoder auto-detects which SAML web binding produced your payload:
- HTTP-POST binding — the assertion is plain base64 of the XML. This is what you copy out of the hidden
SAMLResponseform field or your browser's network tab. - HTTP-Redirect binding — the assertion is base64 of raw DEFLATE-compressed XML (RFC 1951, with no zlib or gzip header) and is usually URL-encoded because it travels in a query-string parameter. This tool URL-decodes and inflates it for you automatically.
You do not have to tell it which one you have — it tries plain base64 first, and falls back to inflating a DEFLATE (or, defensively, gzip/zlib) stream if the bytes are not already XML.
Reading the output
Notes flags the detected binding, whether the input was URL-decoded, a non-Success StatusCode, whether the assertion sits inside its Conditions validity window (checked against the optional Reference Time field, which defaults to now), and whether an XML <Signature> element is present.
Summary lifts the fields you usually care about into a table: Issuer, Destination, InResponseTo, the Subject NameID and its Format, the Conditions NotBefore/NotOnOrAfter window, each AudienceRestriction, the SubjectConfirmationData Recipient, AuthnInstant/SessionIndex, the AuthnContextClassRef, the StatusCode, and every attribute name/value pair from the AttributeStatement.
Decoded XML is the full document, re-indented so nested elements are easy to scan, ready to copy or download.
Does it verify the signature?
No — and this is important. A SAML assertion's trust comes from an XML digital signature that only the IdP's private key can produce, and verifying it requires the IdP's public certificate plus full XML canonicalization. That is out of scope here. This tool reports only whether a <Signature> element exists; it never claims the assertion is authentic or untampered. Treat it as an inspection and troubleshooting aid, not a security control.
Is my SAML data uploaded anywhere?
No. Decoding runs entirely in your browser — the assertion you paste never leaves your device, which matters because a real SAML response can contain a live authentication token and personal attributes. Shareable links for this tool deliberately carry only your settings, never the pasted assertion.
Common uses
Debugging a failed SSO login, confirming the SP is the intended Audience, checking whether an assertion expired before it reached the SP, reading which attributes an IdP actually released, and inspecting an AuthnRequest your SP generated for the HTTP-Redirect binding.